From 647316dbf291fceceea18ecfa296c021205a225b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 12 Feb 2026 09:45:51 +0000
Subject: [PATCH] better krb5 dockerfile setup

---
 Dockerfile              | 4 +++-
 docker/DockerfileFullEe | 3 +++
 docker/RHEL8/Dockerfile | 5 ++++-
 docker/RHEL9/Dockerfile | 5 ++++-
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 6fa79b12b0..6ad8713931 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -132,6 +132,7 @@ ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
 ARG WITH_HELM=true
 ARG WITH_GIT=true
+ARG features=""
 
 # To change latest stable version:
 # 1. Change placeholder in instanceSettings.ts
@@ -149,7 +150,8 @@ ENV PATH /usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
 
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 software-properties-common tini libsasl2-modules-gssapi-mit krb5-user \
+    && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 software-properties-common tini \
+    && if echo "$features" | grep -q "ee"; then apt-get install -y --no-install-recommends libsasl2-modules-gssapi-mit krb5-user; fi \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
diff --git a/docker/DockerfileFullEe b/docker/DockerfileFullEe
index 7404f42efa..0476ee2c10 100644
--- a/docker/DockerfileFullEe
+++ b/docker/DockerfileFullEe
@@ -54,6 +54,9 @@ RUN apt-get install -y ruby ruby-bundler
 # iptables
 RUN apt-get install -y iptables
 
+# Kerberos runtime
+RUN apt-get install -y libsasl2-modules-gssapi-mit krb5-user
+
 # Fix UV cache permissions for non-root user support (uid 1000, etc.)
 # The uv tool install ansible command populates the UV cache with root-owned files
 RUN chmod -R a+rw /tmp/windmill/cache/uv && \
diff --git a/docker/RHEL8/Dockerfile b/docker/RHEL8/Dockerfile
index 6918ece6e0..f18d35ccf4 100644
--- a/docker/RHEL8/Dockerfile
+++ b/docker/RHEL8/Dockerfile
@@ -64,7 +64,7 @@ RUN --mount=type=secret,id=rh_username \
 RUN subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
 
 RUN yum update -y && \
-    yum install -y perl-interpreter perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel krb5-devel krb5-workstation cyrus-sasl-devel cyrus-sasl-gssapi libcurl-devel clang llvm-devel cmake libtool-ltdl-devel
+    yum install -y perl-interpreter perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel krb5-devel cyrus-sasl-devel libcurl-devel clang llvm-devel cmake libtool-ltdl-devel
 
 # RUN --mount=type=cache,target=/usr/local/cargo/registry \
 #     CARGO_NET_GIT_FETCH_WITH_CLI=true RUST_BACKTRACE=1 cargo chef cook --release --features "$features" --recipe-path recipe.json
@@ -86,4 +86,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 RUN mkdir -p /usr/src/app && \
     cp windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
 
+# Runtime Kerberos packages (installed separately from build deps)
+RUN yum install -y krb5-workstation cyrus-sasl-gssapi
+
 RUN subscription-manager unregister
diff --git a/docker/RHEL9/Dockerfile b/docker/RHEL9/Dockerfile
index 31c474af77..a7048d1797 100644
--- a/docker/RHEL9/Dockerfile
+++ b/docker/RHEL9/Dockerfile
@@ -64,7 +64,7 @@ RUN --mount=type=secret,id=rh_username \
 RUN subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms
 
 RUN yum update -y && \
-    yum install -y perl-FindBin perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel krb5-devel krb5-workstation cyrus-sasl-devel cyrus-sasl-gssapi libcurl-devel clang llvm-devel cmake libtool-ltdl-devel
+    yum install -y perl-FindBin perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel krb5-devel cyrus-sasl-devel libcurl-devel clang llvm-devel cmake libtool-ltdl-devel
 
 # RUN --mount=type=cache,target=/usr/local/cargo/registry \
 #     CARGO_NET_GIT_FETCH_WITH_CLI=true RUST_BACKTRACE=1 cargo chef cook --release --features "$features" --recipe-path recipe.json
@@ -86,4 +86,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 RUN mkdir -p /usr/src/app && \
     cp windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
 
+# Runtime Kerberos packages (installed separately from build deps)
+RUN yum install -y krb5-workstation cyrus-sasl-gssapi
+
 RUN subscription-manager unregister